Cisco IOS XE Dialer Interface Feature for ISDN improper authentication

Summaryinfo

A vulnerability was found in Cisco IOS XE. It has been declared as critical. This vulnerability affects unknown code of the component Dialer Interface Feature for ISDN. Executing a manipulation can lead to improper authentication. This vulnerability appears as CVE-2019-12664. The attacker needs to be present on the local network. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco IOS XE (Router Operating System) (version now known). It has been declared as critical. This vulnerability affects some unknown processing of the component Dialer Interface Feature for ISDN. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers (ISRs) could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The vulnerability is due to insufficient validation of the state of the PPP IP Control Protocol (IPCP). An attacker could exploit this vulnerability by making an ISDN call to an affected device and sending traffic through the ISDN channel prior to successful PPP authentication. Alternatively, an unauthenticated, remote attacker could exploit this vulnerability by sending traffic through an affected device that is configured to exit via an ISDN connection for which both the Dialer interface and the Basic Rate Interface (BRI) have been configured, but the Challenge Handshake Authentication Protocol (CHAP) password for PPP does not match the remote end. A successful exploit could allow the attacker to pass IPv4 traffic through an unauthenticated ISDN connection for a few seconds, from initial ISDN call setup until PPP authentication fails.

The weakness was presented 09/25/2019 as cisco-sa-20190925-isdn-data-le as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2019-12664 since 06/04/2019. Access to the local network is required for this attack to succeed. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

See VDB-142291, VDB-142290, VDB-142287 and VDB-142285 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion